@incodetech/web 2.3.2-rc.4 → 2.4.0-rc.0

package/dist/{tl-CUyJhGKF.js → tl-BjxdIajM.js}

@@ -3127,6 +3127,7 @@ var tl_default = {
 			"invalidSessionResponse": "Hindi wastong tugon sa sesyon.",
 			"missingFlowConfiguration": "Nawawalang konfigurasyon ng daloy.",
 			"restartLabel": "I-restart ang onboarding",
+			"sessionExpiredMessage": "Nag-expire na ang iyong sesyon. Simulan muli ang proseso upang magpatuloy.",
 			"sessionInvalidMessage": "Hindi na magagamit ang sesyon ng pag-verify na ito. Mangyaring magsimula ng bago upang magpatuloy.",
 			"sessionRestartDisabledMessage": "Nakumpleto na ang sesyon ng pag-verify na ito at hindi na maaaring muling buksan.",
 			"sessionUnavailableTitle": "Hindi na magagamit ang sesyon",

package/dist/{tl-PH-D6NzZs7e.js → tl-PH-C_wJmHt1.js}

@@ -3127,6 +3127,7 @@ var tl_PH_default = {
 			"invalidSessionResponse": "Hindi wastong tugon sa sesyon.",
 			"missingFlowConfiguration": "Nawawalang konfigurasyon ng daloy.",
 			"restartLabel": "I-restart ang onboarding",
+			"sessionExpiredMessage": "Nag-expire na ang iyong sesyon. Simulan muli ang proseso upang magpatuloy.",
 			"sessionInvalidMessage": "Hindi na magagamit ang sesyon ng pag-verify na ito. Mangyaring magsimula ng bago upang magpatuloy.",
 			"sessionRestartDisabledMessage": "Nakumpleto na ang sesyon ng pag-verify na ito at hindi na maaaring muling buksan.",
 			"sessionUnavailableTitle": "Hindi na magagamit ang sesyon",

package/dist/{tr-BTjhr_32.js → tr-BhmOJl6w.js}

@@ -2182,7 +2182,7 @@ var tr_default = {
 		"noAttemptsRemaining": "Kalan deneme yok",
 		"noFace": "Yüz algılanmadı",
 		"noMatch": "Eşleşme yok, tekrar deneyin",
-		"nonexistentCustomer": "Kayıtınızı bulamadık",
+		"nonexistentCustomer": "Kayıtlarınızı bulamadık",
 		"nonexistentCustomerDescription": "Doğrulama işlemini yeniden başlatın; bu durum devam ederse destek ekibiyle iletişime geçin",
 		"noTries": "Maksimum deneme sayısına ulaşıldı",
 		"onBlur": "Net bir görüntü yakalamak için telefonunuzu sabit tutun",
@@ -2807,7 +2807,7 @@ var tr_default = {
 		"addressPlaceholder": "Arama",
 		"addressSearch": "Adresi girin",
 		"dlState": { "searchPlaceholder": "Eyalet için arama" },
-		"enterManually": "Elle girin",
+		"enterManually": "Manuel olarak girin",
 		"errors": {
 			"addressIsRequired": "Adres gereklidir",
 			"ARPostalCodeInvalidFormat": "Lütfen geçerli bir Arjantin Posta Kodu girin (format: A1111AAA)",
@@ -3127,6 +3127,7 @@ var tr_default = {
 			"invalidSessionResponse": "Geçersiz oturum yanıtı.",
 			"missingFlowConfiguration": "Akış yapılandırması eksik.",
 			"restartLabel": "Oryantasyon sürecini yeniden başlat",
+			"sessionExpiredMessage": "Oturumunuzun süresi doldu. Devam etmek için işlemi yeniden başlatın.",
 			"sessionInvalidMessage": "Bu doğrulama oturumu artık kullanılamıyor. Devam etmek için lütfen yeni bir oturum başlatın.",
 			"sessionRestartDisabledMessage": "Bu doğrulama oturumu zaten tamamlanmıştır ve artık yeniden açılamaz.",
 			"sessionUnavailableTitle": "Oturum artık kullanılamıyor",

package/dist/transitionSpinner-CPK1gaqC.js

@@ -0,0 +1,76 @@
+import { o as useTranslation, r as useUiConfig } from "./uiConfig-CzjzpmLx.js";
+import { u as T, v as u } from "./vendor-preact-C0jX1Cbq.js";
+import { u as useInstanceOverrides } from "./spacer-CRMb016O.js";
+import { t as Spinner } from "./spinner-B2lU14AQ.js";
+//#region src/shared/spinner/resolveSpinnerPresentation.ts
+/**
+* Collapses the per-instance and global tiers into one presentation, mirroring
+* the tier order `resolveAsset` uses: instance wins, global fills the gaps.
+*
+* Resolution is **per field**, not per object, so a global `size` survives an
+* instance that only sets `renderMode`. Fields absent from both tiers come back
+* `undefined` rather than defaulted — the caller owns the fallback, because the
+* built-in default differs per call site.
+*/
+function resolveSpinnerPresentation(scopes) {
+	const { instance, global } = scopes;
+	return {
+		renderMode: instance?.renderMode ?? global?.renderMode,
+		size: instance?.size ?? global?.size
+	};
+}
+//#endregion
+//#region src/shared/spinner/useSpinnerPresentation.ts
+/**
+* Reads the host's loader presentation from the per-instance and global tiers.
+*
+* Mirrors `useAsset`: the instance tier rides on the module's `config` prop and
+* is published once at the module root by `registerIncodeModuleElement`, so a
+* deep `<TransitionSpinner>` reads it without prop drilling. Outside a provider
+* `useInstanceOverrides()` returns a stable empty object, so the dep array
+* never churns.
+*/
+function useSpinnerPresentation() {
+	const instance = useInstanceOverrides();
+	const uiConfig = useUiConfig();
+	return T(() => resolveSpinnerPresentation({
+		instance: instance.spinner,
+		global: uiConfig.spinner
+	}), [instance.spinner, uiConfig.spinner]);
+}
+//#endregion
+//#region src/shared/processing/transitionSpinner.tsx
+/**
+* Canonical "we're getting ready / processing" loader.
+*
+* Renders a container-filling `Spinner` with the unified `loadingCircle.holdOn`
+* / `loadingCircle.validating` copy at `size="large"` so every cross-module
+* transition looks identical to the user.
+*
+* Presentation resolves per field as host instance → host global → call site →
+* built-in. Host tiers win so a single `setup({ uiConfig: { spinner } })` reaches
+* the module-internal loaders (ID camera prep, camera permissions) that a
+* flow-level config never could.
+*/
+var TransitionSpinner = ({ spinnerConfig, className, titleKey, subtitleKey, renderMode, hideText = false, presentational = false, alwaysDark = false }) => {
+	const { t } = useTranslation();
+	const presentation = useSpinnerPresentation();
+	const resolvedRenderMode = presentation.renderMode ?? spinnerConfig?.renderMode ?? renderMode ?? (hideText ? "spinnerOnly" : "spinnerAndText");
+	const showText = resolvedRenderMode !== "spinnerOnly";
+	const hideIcon = resolvedRenderMode === "textOnly";
+	const title = showText ? spinnerConfig?.title ?? t(titleKey ?? "loadingCircle.holdOn") : void 0;
+	const subtitle = showText ? spinnerConfig?.subtitle ?? t(subtitleKey ?? "loadingCircle.validating") : void 0;
+	return /* @__PURE__ */ u(Spinner, {
+		title,
+		subtitle,
+		ariaLabel: presentational ? void 0 : [title, subtitle].filter(Boolean).join(". ") || void 0,
+		size: presentation.size ?? spinnerConfig?.size ?? "large",
+		fullScreen: true,
+		className,
+		presentational,
+		hideIcon,
+		alwaysDark
+	});
+};
+//#endregion
+export { TransitionSpinner as t };

package/dist/{tutorial-BywSwy2f.js → tutorial-D9Tr_r15.js}

@@ -1,14 +1,15 @@
-import { o as useTranslation } from "./uiConfig-qMQHPoxa.js";
+import { o as useTranslation } from "./uiConfig-CzjzpmLx.js";
 import { S as k, _ as y, c as A, f as d, h as q, p as g, v as u } from "./vendor-preact-C0jX1Cbq.js";
-import { c as Page, d as TransitionSpinner } from "./incodeComponent-CdiXt7v7.js";
-import { a as useAnimationData, d as cn, n as LoadingIcon, t as Spacer } from "./spacer-BmQEPV3n.js";
-import { t as Title } from "./typography-Cn7-Znpn.js";
-import { r as SuccessIcon } from "./icons-lmBQFGnv.js";
-import { t as ErrorContent } from "./errorContent-T3IsDggM.js";
-import { t as ConnectionError } from "./connectionError-C7NJ8tzk.js";
-import { c as useCoverMedia } from "./denied-D9PfdAvK.js";
-import { t as BaseTutorial } from "./baseTutorial-DO4gqrJQ.js";
-import { t as ManualCaptureButton } from "./manualCaptureButton-wmNH54-0.js";
+import { a as useAnimationData, d as cn, n as LoadingIcon, t as Spacer } from "./spacer-CRMb016O.js";
+import { t as Title } from "./typography-CVggEHuL.js";
+import { t as TransitionSpinner } from "./transitionSpinner-CPK1gaqC.js";
+import { r as SuccessIcon } from "./icons-Cri5P1f0.js";
+import { t as Page } from "./page-BzEithea.js";
+import { t as ErrorContent } from "./errorContent-i-XKbliC.js";
+import { t as ConnectionError } from "./connectionError-DnLv1SEA.js";
+import { t as useCoverMedia } from "./useCoverMedia-VLw3OYN_.js";
+import { t as BaseTutorial } from "./baseTutorial-CW-zwkOM.js";
+import { t as ManualCaptureButton } from "./manualCaptureButton-DghY-ZUO.js";
 //#region src/shared/capture/faceOutline.tsx
 var FaceOutline = () => {
 	return /* @__PURE__ */ u("svg", {
@@ -21,7 +22,7 @@ var FaceOutline = () => {
 		"aria-hidden": "true",
 		children: [/* @__PURE__ */ u("title", { children: "Outline" }), /* @__PURE__ */ u("path", {
 			opacity: "0.8",
-			d: "M145.633 8.0625C115.606 8.06268 85.6206 26.5984 76.9712 54.293L76.771 54.9492C70.4539 76.1063 75.0139 100.802 76.8687 110.58L77.3628 113.188L75.1528 114.656C66.1187 120.66 63.5861 124.089 62.8472 126.92C62.4669 128.377 62.4644 130.035 62.8003 132.412C63.1635 134.983 63.7533 137.484 64.4233 141.347L64.5142 141.841C65.5056 146.956 68.1062 152.133 71.2749 156.618C74.5527 161.257 78.2056 164.826 80.7349 166.584L82.4517 167.777V169.869C82.4517 177.866 85.3476 186.144 89.6763 194.128C93.9906 202.085 99.5748 209.473 104.623 215.646L105.526 216.751V218.178C105.526 220.891 105.68 223.73 105.801 226.9C105.92 230.011 106.003 233.347 105.828 236.771C105.475 243.652 104.077 251.044 99.7446 258.227C91.1977 272.397 72.1081 284.401 31.8677 291.776L29.936 292.124C-41.1597 304.684 -61.4563 361.617 -63.2153 392.062H145.633V400.062H-71.3638L-71.3462 396.044C-71.2048 364.597 -50.9804 298.295 28.5444 284.246L30.4448 283.904C69.9919 276.654 86.1642 265.253 92.894 254.095C96.3216 248.412 97.5261 242.442 97.8374 236.362C97.9939 233.307 97.9241 230.262 97.8071 227.206C97.7111 224.697 97.5799 222.105 97.5396 219.615C92.5931 213.5 87.048 206.064 82.644 197.941C78.308 189.944 74.9442 181.04 74.5024 171.896C71.3932 169.387 67.8531 165.638 64.7417 161.234C61.1656 156.173 57.9337 149.942 56.6587 143.353L56.5415 142.714C55.9864 139.514 55.2491 136.155 54.8784 133.531C54.4806 130.715 54.3377 127.843 55.106 124.899C56.5344 119.427 60.7885 114.886 68.5259 109.489C66.4692 98.2995 62.7062 74.0938 69.106 52.6602L69.3345 51.9092C79.2266 20.2173 112.853 0.0626788 145.633 0.0625V8.0625ZM145.635 0.0625C178.415 0.0625 212.042 20.2172 221.934 51.9092L222.163 52.6602C228.562 74.0938 224.799 98.2996 222.743 109.489C230.48 114.886 234.734 119.427 236.163 124.899C236.931 127.843 236.788 130.715 236.39 133.531C236.019 136.155 235.282 139.514 234.727 142.714L234.61 143.353C233.335 149.942 230.103 156.173 226.527 161.234C223.415 165.638 219.875 169.387 216.766 171.896C216.324 181.04 212.961 189.944 208.625 197.941C204.221 206.064 198.676 213.5 193.729 219.615C193.689 222.105 193.557 224.697 193.461 227.206C193.344 230.262 193.275 233.307 193.431 236.362C193.742 242.442 194.947 248.412 198.375 254.095C205.104 265.253 221.277 276.654 260.824 283.904L262.724 284.246C342.249 298.294 362.473 364.597 362.615 396.044L362.632 400.062H145.635V392.062H354.484C352.725 361.616 332.429 304.683 261.333 292.124L259.401 291.776C219.161 284.401 200.071 272.397 191.524 258.227C187.192 251.044 185.793 243.652 185.441 236.771C185.266 233.347 185.348 230.011 185.467 226.9C185.589 223.73 185.743 220.891 185.743 218.178V216.751L186.646 215.646C191.694 209.473 197.278 202.085 201.592 194.128C205.921 186.144 208.817 177.866 208.817 169.869V167.777L210.534 166.584C213.063 164.826 216.716 161.257 219.994 156.618C223.162 152.133 225.763 146.956 226.754 141.841L226.845 141.347C227.515 137.484 228.105 134.983 228.468 132.412C228.804 130.034 228.802 128.377 228.421 126.92C227.682 124.089 225.15 120.66 216.116 114.656L213.906 113.188L214.4 110.58C216.255 100.802 220.815 76.1064 214.498 54.9492L214.297 54.293C205.648 26.5983 175.662 8.0625 145.635 8.0625V0.0625Z",
+			d: "M145.633 8.063c-30.027 0-60.012 18.535-68.662 46.23l-.2.656c-6.317 21.157-1.757 45.853.098 55.631l.494 2.608-2.21 1.468c-9.034 6.004-11.567 9.433-12.306 12.264-.38 1.457-.383 3.115-.047 5.492.364 2.571.953 5.072 1.623 8.935l.091.494c.992 5.115 3.592 10.292 6.76 14.777 3.279 4.639 6.932 8.208 9.46 9.966l1.718 1.193v2.092c0 7.997 2.896 16.275 7.224 24.259 4.315 7.957 9.899 15.345 14.947 21.518l.903 1.105v1.427c0 2.713.154 5.552.275 8.722.119 3.111.202 6.447.027 9.871-.353 6.881-1.751 14.273-6.083 21.456-8.547 14.17-27.637 26.174-67.877 33.549l-1.932.348c-71.096 12.56-91.392 69.493-93.151 99.938h208.848v8H-71.364l.018-4.018c.141-31.447 20.366-97.749 99.89-111.798l1.9-.342c39.548-7.25 55.72-18.651 62.45-29.809 3.428-5.683 4.632-11.653 4.943-17.733.157-3.055.087-6.1-.03-9.156-.096-2.509-.227-5.101-.267-7.591-4.947-6.115-10.492-13.551-14.896-21.674-4.336-7.997-7.7-16.901-8.142-26.045-3.109-2.509-6.649-6.258-9.76-10.662-3.576-5.061-6.808-11.292-8.083-17.881l-.117-.639c-.556-3.2-1.293-6.559-1.664-9.183-.397-2.816-.54-5.688.228-8.632 1.428-5.472 5.682-10.013 13.42-15.41-2.057-11.19-5.82-35.395.58-56.829l.229-.75C79.227 20.216 112.853.062 145.633.062zm.002-8c32.78 0 66.407 20.154 76.299 51.846l.229.751c6.399 21.434 2.636 45.64.58 56.829 7.737 5.397 11.991 9.938 13.42 15.41.768 2.944.625 5.816.227 8.632-.371 2.624-1.108 5.983-1.663 9.183l-.117.639c-1.275 6.589-4.507 12.82-8.083 17.881-3.112 4.404-6.652 8.153-9.761 10.662-.442 9.144-3.805 18.048-8.141 26.045-4.404 8.123-9.949 15.559-14.896 21.674-.04 2.49-.172 5.082-.268 7.591-.117 3.056-.186 6.101-.03 9.156.311 6.08 1.516 12.05 4.944 17.733 6.729 11.158 22.902 22.559 62.449 29.809l1.9.342c79.525 14.048 99.749 80.351 99.891 111.798l.017 4.018H145.635v-8h208.849c-1.759-30.446-22.055-87.379-93.151-99.938l-1.932-.348c-40.24-7.375-59.33-19.379-67.877-33.549-4.332-7.183-5.731-14.575-6.083-21.456-.175-3.424-.093-6.76.026-9.871.122-3.17.276-6.009.276-8.722v-1.427l.903-1.105c5.048-6.173 10.632-13.561 14.946-21.518 4.329-7.984 7.225-16.262 7.225-24.259v-2.092l1.717-1.193c2.529-1.758 6.182-5.327 9.46-9.966 3.168-4.485 5.769-9.662 6.76-14.777l.091-.494c.67-3.863 1.26-6.364 1.623-8.935.336-2.378.334-4.035-.047-5.492-.739-2.831-3.271-6.26-12.305-12.264l-2.21-1.468.494-2.608c1.855-9.778 6.415-34.474.098-55.63l-.201-.657c-8.649-27.695-38.635-46.23-68.662-46.23z",
 			fill: "white"
 		})]
 	});
@@ -49,7 +50,7 @@ var BorderRing = ({ fill, gradientId, gradientColor }) => /* @__PURE__ */ u("svg
 		/* @__PURE__ */ u("path", {
 			"fill-rule": "evenodd",
 			"clip-rule": "evenodd",
-			d: "M335 167.5C335 260.008 260.008 335 167.5 335C74.9923 335 0 260.008 0 167.5C0 74.9923 74.9923 0 167.5 0C260.008 0 335 74.9923 335 167.5ZM167.5 325C254.485 325 325 254.485 325 167.5C325 80.5152 254.485 10 167.5 10C80.5152 10 10 80.5152 10 167.5C10 254.485 80.5152 325 167.5 325Z",
+			d: "M335 167.5c0 92.508-74.992 167.5-167.5 167.5S0 260.008 0 167.5 74.992 0 167.5 0 335 74.992 335 167.5ZM167.5 325c86.985 0 157.5-70.515 157.5-157.5S254.485 10 167.5 10 10 80.515 10 167.5 80.515 325 167.5 325Z",
 			class: "IncodeLoadingBorderPath",
 			fill
 		}),
@@ -532,7 +533,7 @@ var Video = ({ stream, mirrored }) => {
 };
 //#endregion
 //#region src/modules/selfie/tutorial.tsx
-var Tutorial = ({ manager, ageAssurance = false, showManualUploadLink = false }) => {
+var Tutorial = ({ manager, ageAssurance = false }) => {
 	const { t } = useTranslation();
 	const [isLoading, setIsLoading] = d(false);
 	const { data: animationData, isOverride } = useAnimationData("selfie.tutorial");
@@ -550,11 +551,6 @@ var Tutorial = ({ manager, ageAssurance = false, showManualUploadLink = false })
 		buttonText: t(ageAssurance ? "face.tutorial.ageAssuranceStartCapture" : "face.tutorial.startCapture"),
 		disclaimerText: t("face.tutorial.autoCapture"),
 		isLoading,
-		secondaryAction: showManualUploadLink ? {
-			label: t("selfiev2.manualUpload.uploadSelfieManually"),
-			onClick: () => manager.goToManualUpload(),
-			testId: "selfie-manual-upload-link"
-		} : void 0,
 		className: "IncodeSelfieTutorial"
 	});
 };

package/dist/types/ae-signature.d.ts

@@ -3,6 +3,7 @@ import { AeSignatureManager } from '@incodetech/core/ae-signature';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 export declare const AeSignature: FC<Omit<AeSignatureModuleProps, "config"> & {
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-ae-signature': HTMLElement & IncodeModuleProps<AeSignatureConfig,
-  void,
-  AeSignatureManager>;
+        'incode-ae-signature': HTMLElement & import('preact').ComponentProps<typeof AeSignature>;
     }
 }

package/dist/types/antifraud.d.ts

@@ -3,6 +3,7 @@ import { AntifraudManager } from '@incodetech/core/antifraud';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-antifraud': HTMLElement & IncodeModuleProps<AntifraudConfig,
-  void,
-  AntifraudManager>;
+        'incode-antifraud': HTMLElement & import('preact').ComponentProps<typeof Antifraud>;
     }
 }

package/dist/types/authentication.d.ts

@@ -3,6 +3,7 @@ import { AuthenticationManager } from '@incodetech/core/authentication';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -81,6 +82,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -94,7 +104,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -114,8 +127,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -130,6 +145,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -141,6 +163,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -172,8 +196,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-authentication': HTMLElement & IncodeModuleProps<AuthenticationConfig & { authHint?: string },
-  void,
-  AuthenticationManager>;
+        'incode-authentication': HTMLElement & import('preact').ComponentProps<typeof Authentication>;
     }
 }

package/dist/types/certificate-issuance.d.ts

@@ -3,6 +3,7 @@ import { CertificateIssuanceManager } from '@incodetech/core/certificate-issuanc
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-certificate-issuance': HTMLElement & IncodeModuleProps<CertificateIssuanceConfig,
-  void,
-  CertificateIssuanceManager>;
+        'incode-certificate-issuance': HTMLElement & import('preact').ComponentProps<typeof CertificateIssuance>;
     }
 }

package/dist/types/consent.d.ts

@@ -3,6 +3,7 @@ import { ConsentManager } from '@incodetech/core/consent';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,6 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-consent': HTMLElement & IncodeModuleProps<ConsentConfig, void, ConsentManager>;
+        'incode-consent': HTMLElement & import('preact').ComponentProps<typeof Consent>;
     }
 }